CVE-2026-30615: Windsurf MCP Config Rewrite Command Execution
A vulnerability in Windsurf allowed attacker-controlled content to rewrite local MCP config and register a malicious server, leading to command execution.
Category: Critical CVEs
Critical and exploited CVEs, vulnerability intelligence and remediation guidance.
New Linux ‘pedit COW’ Exploit Grants Root Access by Poisoning Cached Binaries
A critical vulnerability in the Linux kernel's traffic-control subsystem, tracked as CVE-2026-46331 and nicknamed 'pedit COW,' allows a local unprivileged user to…
CVE-2026-46331: pedit COW Privilege Escalation in Linux Kernel
A recently disclosed flaw in the Linux kernel's act_pedit Traffic Control subsystem, known as pedit COW, allows unprivileged users to escalate privileges…
CVE-2026-43500: Dirty Frag Linux Kernel Vulnerability
A Linux kernel flaw in the Dirty Frag family that allows local privilege escalation when CAP_NET_ADMIN is set. It was among the…
CVE-2026-46300: Fragnesia Linux Kernel Vulnerability
CVE-2026-46300, known as Fragnesia, bypassed the DirtyFrag patch through a flag-dropping bug in skb_try_coalesce(). It allowed local privilege escalation by exploiting the…
DirtyClone Linux Kernel Flaw CVE-2026-43503 Allows Local Privilege Escalation to Root
A new Linux kernel privilege escalation vulnerability, tracked as CVE-2026-43503 and nicknamed DirtyClone, has been publicly disclosed with a working exploit. Discovered…
CVE-2026-43503: DirtyClone Linux Kernel Vulnerability
A Linux kernel flaw known as DirtyClone that allows local privilege escalation when CAP_NET_ADMIN is set. It was among the vulnerabilities targeted…
CVE-2026-43284: Dirty Frag Linux Kernel Vulnerability
A Linux kernel flaw in the Dirty Frag family that allows local privilege escalation when CAP_NET_ADMIN is set. It was among the…
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC…
CVE-2025-8088: WinRAR Flaw Exploited by Gamaredon
A now-patched flaw in WinRAR (CVE-2025-8088) was weaponized by Gamaredon to place malicious HTA downloaders into the Windows Startup folder, enabling automatic…